Containing Malicious Package Updates in npm with a Lightweight Permission System

The large amount of third-party packages available in fast-moving software ecosystems, such as Node.js/npm, enables attackers to compromise applications by pushing malicious updates to their package dependencies. Studying the npm repository, we observed that many packages in the npm repository that...

Celý popis

Podrobná bibliografia

Vydané v:	Proceedings / International Conference on Software Engineering s. 1334 - 1346
Hlavní autori:	Ferreira, Gabriel, Jia, Limin, Sunshine, Joshua, Kastner, Christian
Médium:	Konferenčný príspevok..
Jazyk:	English
Vydavateľské údaje:	IEEE 01.05.2021
Predmet:	design trade-offs Ecosystems malicious package updates package management permission system Runtime sandboxing Security Software supplychain security
ISBN:	1665402962, 9781665402965
ISSN:	1558-1225
On-line prístup:	Získať plný text
Tagy:	Pridať tag Žiadne tagy, Buďte prvý, kto otaguje tento záznam!